fix(cutover): remount traefik edge imports #589

Merged

pdurlej merged 1 commit from codex/m01-remount-traefik-edge-data into main

2026-05-29 00:33:44 +02:00

codex commented

2026-05-29 00:33:33 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Summary

M01 edge remount batch for traefik.

This PR moves Traefik dynamic config and ACME store defaults to prepared legacy-import paths:

/opt/pdurlej-platform/runtime/legacy-import/config/traefik/dynamic
/opt/pdurlej-platform/runtime/legacy-import/data/traefik/acme.json

The old legacy paths remain available as explicit rollback env vars for one rollback cycle.

Canary Context Pack

Product story

M01 needs active services to stop depending on /opt/vps-home-platform-infra before quarantine/destructive cleanup. Traefik is edge-critical, so this PR is intentionally isolated and keeps rollback simple.

What changed

compose/edge/compose.yaml: Traefik dynamic config and ACME mounts now default to copied legacy-import paths.
modules/traefik/runbook.md: documents sources and rollback env vars.

Why it changed

The legacy root must stop being the default runtime source. This keeps old paths as rollback material while making the canonical release root independent of the legacy project tree.

Files touched

compose/edge/compose.yaml
modules/traefik/runbook.md

Relevant context

M01 RS2000 closeout critical path
Prior remount batches applied cleanly: ntfy, dashboard, searxng, coredns, matrix-well-known, shelfmark, np-meerkat-backend
Live Traefik also had an old certs mount, but current desired compose does not declare it and dynamic config has no certFile/keyFile references.

Runtime evidence

Prep copy already run on RS2000 before this PR:

scripts/cutover/prepare-legacy-import.sh --dry-run --path config/traefik/dynamic
scripts/cutover/prepare-legacy-import.sh --yes --path config/traefik/dynamic
target_size 28K /opt/pdurlej-platform/runtime/legacy-import/config/traefik/dynamic

scripts/cutover/prepare-legacy-import.sh --dry-run --path data/traefik/acme.json
scripts/cutover/prepare-legacy-import.sh --yes --path data/traefik/acme.json
target_mode=600 target_size=295689 /opt/pdurlej-platform/runtime/legacy-import/data/traefik/acme.json

No service restart was performed for this PR.

Known constraints

Edge/public ingress impact if rollback is needed.
This does not delete or quarantine legacy paths.
This does not intentionally change Traefik dynamic config or ACME contents.
This does not recreate the container before merge.

Explicit out-of-scope

destructive cleanup
quarantine/tombstone
cert rotation
changing public exposure rules
Matrix/Synapse data
Vault sunset/bootstrap

Requested decision

Approve this isolated edge remount if local validation is green; pending-only Actions may be admin force-merged under operator authorization.

Merge blockers

copied Traefik targets missing on RS2000
compose syntax failure
local validation failure
dynamic config references cert paths not mounted by desired compose
reviewer identifies a rollback risk not covered by rollback env vars

Validation

git diff --check: passed
PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json: passed, exit 0
RS2000 dynamic config cert path grep: 0 certFile/keyFile references

Spec sources read

compose/edge/compose.yaml — mount declaration
modules/traefik/runbook.md — operator rollback/runbook update

Non-goals

No DB, no service, no webhooks, no issue/comment mutation, no destructive cleanup.

Canary status: missing — fire canary 3+3 manually before merge ## Summary M01 edge remount batch for `traefik`. This PR moves Traefik dynamic config and ACME store defaults to prepared `legacy-import` paths: - `/opt/pdurlej-platform/runtime/legacy-import/config/traefik/dynamic` - `/opt/pdurlej-platform/runtime/legacy-import/data/traefik/acme.json` The old legacy paths remain available as explicit rollback env vars for one rollback cycle. ## Canary Context Pack ### Product story M01 needs active services to stop depending on `/opt/vps-home-platform-infra` before quarantine/destructive cleanup. Traefik is edge-critical, so this PR is intentionally isolated and keeps rollback simple. ### What changed - `compose/edge/compose.yaml`: Traefik dynamic config and ACME mounts now default to copied `legacy-import` paths. - `modules/traefik/runbook.md`: documents sources and rollback env vars. ### Why it changed The legacy root must stop being the default runtime source. This keeps old paths as rollback material while making the canonical release root independent of the legacy project tree. ### Files touched - `compose/edge/compose.yaml` - `modules/traefik/runbook.md` ### Relevant context - M01 RS2000 closeout critical path - Prior remount batches applied cleanly: `ntfy`, `dashboard`, `searxng`, `coredns`, `matrix-well-known`, `shelfmark`, `np-meerkat-backend` - Live Traefik also had an old certs mount, but current desired compose does not declare it and dynamic config has no `certFile`/`keyFile` references. ### Runtime evidence Prep copy already run on RS2000 before this PR: ```text scripts/cutover/prepare-legacy-import.sh --dry-run --path config/traefik/dynamic scripts/cutover/prepare-legacy-import.sh --yes --path config/traefik/dynamic target_size 28K /opt/pdurlej-platform/runtime/legacy-import/config/traefik/dynamic scripts/cutover/prepare-legacy-import.sh --dry-run --path data/traefik/acme.json scripts/cutover/prepare-legacy-import.sh --yes --path data/traefik/acme.json target_mode=600 target_size=295689 /opt/pdurlej-platform/runtime/legacy-import/data/traefik/acme.json ``` No service restart was performed for this PR. ### Known constraints - Edge/public ingress impact if rollback is needed. - This does not delete or quarantine legacy paths. - This does not intentionally change Traefik dynamic config or ACME contents. - This does not recreate the container before merge. ### Explicit out-of-scope - destructive cleanup - quarantine/tombstone - cert rotation - changing public exposure rules - Matrix/Synapse data - Vault sunset/bootstrap ### Requested decision Approve this isolated edge remount if local validation is green; pending-only Actions may be admin force-merged under operator authorization. ### Merge blockers - copied Traefik targets missing on RS2000 - compose syntax failure - local validation failure - dynamic config references cert paths not mounted by desired compose - reviewer identifies a rollback risk not covered by rollback env vars ## Validation - `git diff --check`: passed - `PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json`: passed, exit 0 - RS2000 dynamic config cert path grep: 0 `certFile`/`keyFile` references ## Spec sources read - `compose/edge/compose.yaml` — mount declaration - `modules/traefik/runbook.md` — operator rollback/runbook update ## Non-goals No DB, no service, no webhooks, no issue/comment mutation, no destructive cleanup.

codex added this to the 01 - RS2000 closeout and legacy cleanup milestone

2026-05-29 00:33:33 +02:00

codex added the

class/security-sensitive

tier/full